Maestro & Unibot

In late October, attackers exploited missing access control in the Maestro and Unibot Telegram trading bot router contracts to perform arbitrary external calls and invoke transferFrom on users' pre-approved ERC-20 tokens. The two incidents affected 106 users and resulted in roughly $1.1M in losses after stolen tokens were swapped for ETH; the underlying flaw was an unprotected router function lacking permission and parameter checks, and users are advised to regularly check and revoke unnecessary token approvals.